Adobe patches 11 ColdFusion vulnerabilities including RCE
Adobe released patches for 11 vulnerabilities in ColdFusion 2023 and 2025, including flaws enabling remote code execution, privilege escalation, and data confidentiality breaches.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 11 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-48282 as exploited in the wild.
The French CERT (CERT-FR) has published an advisory regarding multiple security vulnerabilities discovered in Adobe ColdFusion. The flaws affect ColdFusion 2023 versions prior to Update 21 and ColdFusion 2025 versions prior to Update 10. The vulnerabilities encompass a range of attack vectors including remote arbitrary code execution, server-side request forgery (SSRF), cross-site scripting (XSS), privilege escalation, and confidentiality breaches.
Adobe addressed these issues in security bulletin APSB26-68 released on June 30, 2026. The advisory references eleven distinct CVE identifiers spanning from CVE-2026-48276 through CVE-2026-48316. Organizations running affected versions of ColdFusion are advised to apply the available security updates immediately.
ColdFusion remains a widely deployed application server platform, particularly in enterprise environments running legacy web applications. The combination of remote code execution capabilities and the server-side nature of these vulnerabilities makes prompt patching critical for organizations using the platform.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned by ColdFusion Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects command interpreters or system utilities spawned as children of the ColdFusion service process, indicative of exploitation of a ColdFusion RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned by ColdFusion Server Process
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|contains:
- \coldfusion
- \jrun.exe
- \runtime\bin\coldfusion.exe
suspicious_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \whoami.exe
- \net.exe
- \certutil.exe
- \mshta.exe
condition: selection and suspicious_child
falsepositives:
- Legitimate administrative scripts or scheduled maintenance tasks configured to run
from the ColdFusion service account
- Backup or monitoring agents that shell out from the ColdFusion process context
level: high
tags:
- attack.t1190
- attack.t1059
id: e3a93941-8c1c-50bc-aacf-5081a26e6044
status: experimental
author: Vorant
Webshell-like File Write by ColdFusion Process into Web Root
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the ColdFusion server process writing new script files (cfm, cfc, jsp) into web-accessible directories, consistent with webshell deployment following exploitation of a ColdFusion RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Webshell-like File Write by ColdFusion Process into Web Root
logsource:
category: file_event
product: windows
detection:
selection:
Image|contains:
- \coldfusion
- \jrun.exe
TargetFilename|endswith:
- .cfm
- .cfc
- .jsp
- .jspx
filter:
TargetFilename|contains:
- \WEB-INF\
- \cache\
condition: selection and not filter
falsepositives:
- Legitimate application deployment or update processes that write .cfm/.cfc files
during normal operation
- Automated CI/CD pipelines pushing ColdFusion application code to the server
level: medium
tags:
- attack.t1505.003
- attack.t1190
id: f110d27e-867c-5b79-afc9-cb0a70802f31
status: experimental
author: Vorant
ColdFusion Process Initiating Outbound Network Connection to Uncommon Port
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects the ColdFusion server process making outbound network connections, which may indicate SSRF exploitation or a reverse shell/C2 callback following exploitation of a ColdFusion vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: ColdFusion Process Initiating Outbound Network Connection to Uncommon Port
logsource:
category: network_connection
product: windows
detection:
selection:
Image|contains:
- \coldfusion
- \jrun.exe
Initiated: 'true'
filter:
DestinationPort:
- 80
- 443
- 1433
- 3306
- 389
- 636
condition: selection and not filter
falsepositives:
- ColdFusion legitimately calling out to external web services, databases, or LDAP
servers configured by the application
- Scheduled tasks within ColdFusion that fetch remote data as part of normal business
logic
level: medium
tags:
- attack.t1071
- attack.t1190
id: 132ada0d-6df9-5b52-b7ec-d872d9502b33
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0821
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,570 reports from 147 sources, 725 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs